A cyberattack against AI music generator Suno, disclosed by Have I Been Pwned on July 20, 2026, compromised the personal and financial data of more than 55.3 million users. The breach occurred in November 2025. As of July 21, 2026, Suno had not publicly disclosed the incident or notified affected individuals.

Have I Been Pwned obtained a copy of the breached dataset and published a breach page at haveibeenpwned.com/Breach/Suno. The stolen data included customers' names, physical addresses, email addresses, phone numbers, purchase records, and partial payment card numbers with expiry dates sourced from Suno's Stripe account. The dataset also contained Suno's source code.

The breach was originally revealed by independent news outlet 404 Media. TechCrunch reached out to Suno co-founder Mikey Shulman for comment; he did not respond.

The source code included in the exfiltrated data allegedly revealed that Suno scraped millions of songs and lyrics from Deezer, Genius, and YouTube to train its AI models. Several major record labels are currently suing Suno, claiming those mass-scraping efforts violate copyright law. The exposed source code, if authenticated, could provide litigation-relevant evidence of the data sources Suno used during model training.

For security practitioners, the data exposure profile is notable. Partial payment card numbers combined with expiry dates, even without full PANs, can facilitate social engineering and credential-stuffing attacks when correlated with names, addresses, and phone numbers. The Stripe-originated payment data indicates the breach touched Suno's billing infrastructure or its integration layer, not just a user-facing application database. The inclusion of source code in the exfiltrated payload raises additional concerns: proprietary model-training pipelines, scraping infrastructure, and internal architecture are now potentially accessible to whoever holds the dataset.

The eight-month gap between the breach occurring and its public surfacing is itself a data point. Under most U.S. state breach-notification statutes and the EU's GDPR, organizations are required to notify affected individuals and regulators within defined timeframes following a breach involving personal data. Suno's apparent non-disclosure through July 2026 raises questions about regulatory exposure that go beyond the reputational damage of the breach itself.

The timing also intersects with the active copyright litigation. Several major record labels are suing Suno over its training-data practices, and the alleged scraping details surfaced through the breach could factor into that legal proceeding. Source code that documents systematic scraping from Deezer, Genius, and YouTube, if entered into evidence, would give plaintiffs concrete material to work with rather than relying on inference or third-party analysis.

The broader context here is one we have watched develop across the AI sector over the past several years. Generative AI companies face dual pressure on the data front: the data they use to train models is increasingly contested on copyright and licensing grounds, while the data they collect from users is subject to mounting regulatory and security expectations. Suno now sits at the intersection of both pressures simultaneously. A breach that exposes training-data practices during active copyright litigation is an unusually concentrated version of a risk profile that many AI companies carry in some degree.

For affected users, the HIBP breach page is the most direct way to check whether their data was included. Given that Suno has not issued its own notification, Have I Been Pwned's publication is currently the primary public channel for this information.

Looking at what this means for the AI sector more broadly, the Suno incident underscores a pattern that security teams at AI companies should weigh carefully. These companies often hold two categories of sensitive data: user personal and payment data, and proprietary training-data pipelines and source code. A single breach can expose both. The defensive implications are straightforward but worth stating: access controls and segmentation that keep billing-integration data separate from source-code repositories and training-pipeline infrastructure limit the blast radius of any single compromise. Whether Suno had such segmentation in place is not publicly known.

What is known is that 55.3 million people had their personal and partial financial data exposed in a breach their service provider chose not to disclose, and that the same breach may have handed copyright plaintiffs a clearer view of how their content was used.